CVE-2021-38428

medium · 5.5

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.

5.5

CVSS

11.4%

EPSS (exploit prob.)

96th

EPSS percentile

2021-11-03

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
deltaww	dialink	<= 1.2.4.0

Check a specific version with /api/v1/cve/match.

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-38428